From 9af75c44812d62008b7c3f459a7c462205e47833 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Fri, 11 Sep 2026 11:09:11 +1200 Subject: [PATCH] unbound: patch CVE-2026-44608 Details: https://nvd.nist.gov/vuln/detail/cve-2026-44608 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../unbound/unbound/CVE-2026-44608.patch | 59 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 60 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-44608.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-44608.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-44608.patch new file mode 100644 index 0000000000..0552804051 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-44608.patch @@ -0,0 +1,59 @@ +From b70913c1208eda8494e2d6dd81910e92b8640dcc Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 20 May 2026 10:22:52 +0200 +Subject: [PATCH] - Fix CVE-2026-44608, Use after free and crash in RPZ code. + Thanks to Qifan Zhang, Palo Alto Networks, for the report. + +(cherry picked from commit 75b6dba593d4fff000434cd64807c6ebd50bd244) + +CVE: CVE-2026-44608 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/75b6dba593d4fff000434cd64807c6ebd50bd244] + +Dropped changes to the Changelog file. + +Signed-off-by: Ankur Tyagi +--- + services/rpz.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/services/rpz.c b/services/rpz.c +index f45cf6542..27f7de861 100644 +--- a/services/rpz.c ++++ b/services/rpz.c +@@ -2468,6 +2468,7 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate* + { + struct auth_zones* az; + struct auth_zone* a; ++ struct dns_msg* ret = NULL; + struct clientip_synthesized_rr* raddr = NULL; + struct rpz* r = NULL; + struct local_zone* z = NULL; +@@ -2511,13 +2512,11 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate* + z = rpz_delegation_point_zone_lookup(is->dp, r->nsdname_zones, + is->qchase.qclass, &match); + if(z != NULL) { +- lock_rw_unlock(&a->lock); + break; + } + + raddr = rpz_delegation_point_ipbased_trigger_lookup(r, is); + if(raddr != NULL) { +- lock_rw_unlock(&a->lock); + break; + } + lock_rw_unlock(&a->lock); +@@ -2532,9 +2531,12 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate* + if(z) { + lock_rw_unlock(&z->lock); + } +- return rpz_apply_nsip_trigger(ms, &is->qchase, r, raddr, a); ++ ret = rpz_apply_nsip_trigger(ms, &is->qchase, r, raddr, a); ++ } else { ++ ret = rpz_apply_nsdname_trigger(ms, &is->qchase, r, z, &match, a); + } +- return rpz_apply_nsdname_trigger(ms, &is->qchase, r, z, &match, a); ++ lock_rw_unlock(&a->lock); ++ return ret; + } + + struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms, diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index 9de6a3c88c..8bd8732fe4 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -22,6 +22,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-42923.patch \ file://CVE-2026-42960.patch \ file://CVE-2026-44390.patch \ + file://CVE-2026-44608.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"